XSS via the DOM

Go to this webpage with a parameter name in the URL, e.g. http://www.cs.ru.nl/~erikpoll/websec/demo/XSS_via_DOM.html?name=John.

JavaScript in this webpage uses the browser's DOM API to retrieve the parameter name from the URL to include include it in the content of the page. If you change the value of the parameter name, say from 'John' to 'Maria', the webpage should change.

Hello ! Welcome to this webpage.

The name parameter can be used to inject HTML mark-up of JavaScript into this webpage. For instance, try the links below:

There is a subtle difference here with a normal (reflected or stored) XSS attack. Normally in the XSS attack the webpage that is sent by the server to the browser already contains the malicous scripa. But the webpage that is sent for the URL above does not have the alert-script for creating the pop-up window in it yet: that script is only introduced in the webpage when the browser starts executing other JavaScritpt.

Some things you can try:

Alter the name parameter in the URL to inject other JavaScript into the webpage. See demo_DOM for inspiration what the JavaScript could do.
Send yourself an email with one of these XSS links. Your email client could warn about scripts in URLs in emails. If it does, you could try to use a URL-shortener, such as https://tinyurl.com, to create a abbreviated URL will hide any script tags from the email client. This will also prevent people from seeing the suspicious script tags in the link before they click on it.

A typical DOM-based XXS injection will not be so simple as on this page. For this page, the way that JavaScript can end up in the webpage, via the name parameter in the URL, is very straightforward. For most web pages that are vulnerable to DOM-based XSS the route by which malicious input can end up in the web page will be far more complicated.

The DOM-based cross-site scripting on this page is no real threat to anyone: you can only injecting JavaScript that you are running client-side in your own browser. The script is sent to the server, but the server does nothing with it: the server just returns a fixed HTML page. It is only when your browser renders this page, and executes the JavaScript inside, that the payload in the name parameter fires.

You could use this webpage to do a XSS attack on someone else, by tricking someone into clicking on link likes the ones above. But there is no interesting data or functionality on www.cs.ru.nl for scripts to abuse: the domain does not set valuable cookies to steal and it does not offer any interesting functionality that such an attack could trigger.

XSS via the DOM

Hello const url = new URL(document.URL); const params = new URLSearchParams(url.search); document.write(params.get('name')); ! Welcome to this webpage.

Hello ! Welcome to this webpage.